Re: [tlug] Snort and IP tables

[Thomas Savarimuthu <viswas_thomas@example.com>]

If you look at the snort configuration, it allows you define as many custom 
network group based on IP. Then the rules are set "src network gto dst 
network".  
I think squid runs as foward cache right?, if so if IPtables allows all 
estrablished connnections inside to outside connection shouldn't be disturbed 
by snort scanning. Add all rules to scan the packets from outside --> inside, 
(ofcourse inside to outside if needed).

-Thomas


On Thursday February 26 2004 10:20, patrick.niessen@example.com wrote:
> I want to run snort on one of my servers that also provides other services
> (eg. squid).  This server has been protected with IPTABLES, only allowing
> legitimate connections.
>
> Is it possible to run snort as an ids on the same machine, or will IPTABLES
> block all not permitted protocols?
>
> Patrick